Threat Detection Engineer - TX, MN, AZ, NC

Information Security Engineer 4 – Threat Detection Engineer (Contingent)

This senior Information Security Engineering role focuses on Threat Detection Engineering for large-scale, multi-cloud enterprise environments. The engineer will design, build, tune, and validate detections across SIEM, EDR/XDR, cloud platforms, and identity systems. The role requires advanced threat understanding, strong detection lifecycle ownership, and high-fidelity detection development aligned with MITRE ATT&CK.

The engineer will partner with SOC, IR, logging/telemetry teams, cloud security, and platform engineering to strengthen threat visibility, reduce noise, and drive high-quality, actionable detection content. Automation, structured engineering processes, and an attacker-mindset approach are essential to success.

Day-to-Day Responsibilities:

Detection Engineering (Core Focus)

• Develop and tune detections across Splunk, CrowdStrike, Microsoft Defender, Sentinel (KQL)
• Interpret attacker TTPs and convert them into detection logic across SIEM, EDR, and cloud telemetry.
• Perform detection gap assessments and prioritize detections tied to emerging threats.

Threat & Attack Analysis

• Map detections to MITRE ATT&CK ensure enterprise TTP coverage.
• Track evolving threats (phishing, ransomware, cloud account compromise, identity abuse).
• Operationalize threat intelligence into actionable detections.

Detection Fidelity & Validation

• Measure and improve signal fidelity (precision/recall).
• Conduct false-positive/negative analysis and refine rules.
• Use adversary simulation tools (Atomic Red Team, Caldera, BAS) to validate coverage.
• Maintain detection dashboards, metrics, and SOC feedback loops.

Data Engineering & Telemetry

• Assess log quality and coverage across Windows, Sysmon, Linux, network telemetry, identity, cloud-native logs.
• Define requirements for new logs; work with infra teams to onboard/normalize sources.

Engineering & Automation

• Use Python or PowerShell to automate detection testing, deployment, and reporting.
• Manage detection content through SDLC-like processes: Git, pull requests, staged releases.
• Support infrastructure-as-code patterns for security controls (nice-to-have).